Skip to content

Commit 3870b37

Browse files
atomic111atomic111
authored
Merge pull request #10 from dev-sec/chris-rock/attributes
use new InSpec attributes
2 parents 6b31604 + 38b538a commit 3870b37

5 files changed

Lines changed: 112 additions & 58 deletions

File tree

‎README.md‎

Lines changed: 16 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -22,40 +22,42 @@ InSpec is an open-source run-time framework and rule language used to specify co
2222

2323
## Attributes
2424

25-
* `TRUSTED_USER = vagrant`
25+
We use a yml attribute file to steer the configuration, the following options are available:
26+
27+
* `trusted_user: vagrant`
2628
define trusted user to control Docker daemon. cis-docker-benchmark-1.6
2729

28-
* `AUTHORIZATION_PLUGIN = authz-broker`
30+
* `authorization_plugin: authz-broker`
2931
define authorization plugin to manage access to Docker daemon. cis-docker-benchmark-2.11
3032

31-
* `LOG_DRIVER = syslog`
33+
* `log_driver: syslog`
3234
define preferable way to store logs. cis-docker-benchmark-2.12
3335

34-
* `LOG_OPTS = syslog-address`
36+
* `log_opts: /syslog-address/`
3537
define Docker daemon log-opts. cis-docker-benchmark-2.12
3638

37-
* `REGISTRY_CERT_PATH = '/etc/docker/certs.d/'`
39+
* `registry_cert_path: /etc/docker/certs.d`
3840
directory contains various Docker registry directories. cis-docker-benchmark-3.7
3941

40-
* `REGISTRY_NAME = '/etc/docker/certs.d/registry_hostname:port'`
42+
* `registry_name: /etc/docker/certs.d/registry_hostname:port`
4143
directory contain certificate certain Docker registry. cis-docker-benchmark-3.7
4244

43-
* `REGISTRY_CA_FILE = '/etc/docker/certs.d/registry_hostname:port/ca.crt'`
45+
* `registry_ca_file: /etc/docker/certs.d/registry_hostname:port/ca.crt`
4446
certificate file for a certain Docker registry certificate files. cis-docker-benchmark-3.7 and cis-docker-benchmark-3.8
4547

46-
* `CONTAINER_USER = 'ubuntu'`
48+
* `container_user: vagrant`
4749
define user within containers. cis-docker-benchmark-4.1
4850

49-
* `APP_ARMOR_PROFILE = 'docker-default'`
51+
* `app_armor_profile: docker-default`
5052
define apparmor profile for Docker containers. cis-docker-benchmark-5.1
5153

52-
* `SELINUX_PROFILE = 'label\:level\:s0-s0\:c1023'`
54+
* `selinux_profile: /label\:level\:s0-s0\:c1023/`
5355
define SELinux profile for Docker containers. cis-docker-benchmark-5.2
5456

55-
* `CONTAINER_CAPADD = nil`
56-
define needed capabilities for containers. example: `CONTAINER_CAPADD="NET_ADMIN,SYS_ADMIN"` cis-docker-benchmark-5.3
57+
* `container_capadd: null`
58+
define needed capabilities for containers. example: `container_capadd: NET_ADMIN,SYS_ADMIN` cis-docker-benchmark-5.3
5759

58-
* `MANAGEABLE_CONTAINER_NUMBER = 25`
60+
* `managable_container_number: 25`
5961
keep number of containers on a host to a manageable total. cis-docker-benchmark-6.5
6062

6163
## Usage
@@ -77,7 +79,7 @@ inspec exec cis-docker-benchmark -t ssh://user@hostname -i /path/to/key
7779
inspec exec cis-docker-benchmark -t ssh://user@hostname -i /path/to/key --sudo
7880
7981
# run profile on remote host via SSH with sudo and define attribute value
80-
TRUSTED_USER=test inspec exec cis-docker-benchmark -t ssh://user@hostname --port 2222 --key-files --sudo
82+
inspec exec cis-docker-benchmark --attrs sample_attributes.yml
8183
8284
# run profile direct from inspec supermarket
8385
inspec supermarket exec dev-sec/cis-docker-benchmark -t ssh://user@hostname --key-files private_key --sudo

‎controls/docker_host_os_level1.rb‎

Lines changed: 15 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -21,12 +21,17 @@
2121

2222
title 'CIS Docker Benchmark - Level 1 - Linux Host OS'
2323

24-
# attributes
25-
attrs = {}
26-
# define trusted user to control Docker daemon. cis-docker-benchmark-1.6
27-
attrs['TRUSTED_USER'] = ENV['TRUSTED_USER'] || 'vagrant'
28-
# keep number of containers on a host to a manageable total. cis-docker-benchmark-6.5
29-
attrs['MANAGEABLE_CONTAINER_NUMBER'] = ENV['MANAGEABLE_CONTAINER_NUMBER'] || 25
24+
TRUSTED_USER = attribute(
25+
'trusted_user',
26+
description: 'define trusted user to control Docker daemon. cis-docker-benchmark-1.6',
27+
default: 'vagrant'
28+
)
29+
30+
MANAGEABLE_CONTAINER_NUMBER = attribute(
31+
'managable_container_number',
32+
description: 'keep number of containers on a host to a manageable total. cis-docker-benchmark-6.5',
33+
default: 25
34+
)
3035

3136
# check if docker exists
3237
only_if do
@@ -108,7 +113,7 @@
108113
end
109114

110115
describe etc_group.where(group_name: 'docker') do
111-
its('users') { should include attrs['TRUSTED_USER'] }
116+
its('users') { should include TRUSTED_USER }
112117
end
113118
end
114119

@@ -152,7 +157,7 @@
152157
ref 'https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Security_Guide/chap-system_auditing.html'
153158

154159
if docker.path
155-
rule = '-w ' << docker.path << ' -p rwxa -k docker'
160+
rule = '-w ' + docker.path + ' -p rwxa -k docker'
156161
describe auditd_rules do
157162
its(:lines) { should include(rule) }
158163
end
@@ -170,7 +175,7 @@
170175
ref 'https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Security_Guide/chap-system_auditing.html'
171176

172177
if docker.path
173-
rule = '-w ' << docker.socket << ' -p rwxa -k docker'
178+
rule = '-w ' + docker.socket + ' -p rwxa -k docker'
174179
describe auditd_rules do
175180
its(:lines) { should include(rule) }
176181
end
@@ -264,6 +269,6 @@
264269
diff = total_on_host - total_running
265270

266271
describe diff do
267-
it { should be <= (attrs['MANAGEABLE_CONTAINER_NUMBER']) }
272+
it { should be <= MANAGEABLE_CONTAINER_NUMBER }
268273
end
269274
end

‎controls/docker_level1.rb‎

Lines changed: 35 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -22,17 +22,34 @@
2222
title 'CIS Docker Benchmark - Level 1 - Docker'
2323

2424
# attributes
25-
attrs = {}
26-
# directory contains various Docker registry directories. cis-docker-benchmark-3.7
27-
attrs['REGISTRY_CERT_PATH'] = ENV['REGISTRY_CERT_PATH'] || '/etc/docker/certs.d'
28-
# directory contain certificate certain Docker registry. cis-docker-benchmark-3.7
29-
attrs['REGISTRY_NAME'] = ENV['REGISTRY_NAME'] || '/etc/docker/certs.d/registry_hostname:port'
30-
# certificate file for a certain Docker registry certificate files. cis-docker-benchmark-3.7 and cis-docker-benchmark-3.8
31-
attrs['REGISTRY_CA_FILE'] = ENV['REGISTRY_CA_FILE'] || '/etc/docker/certs.d/registry_hostname:port/ca.crt'
32-
# define user within containers. cis-docker-benchmark-4.1
33-
attrs['CONTAINER_USER'] = ENV['CONTAINER_USER'] || 'ubuntu'
34-
# define needed capabilities for containers. example: `CONTAINER_CAPADD="NET_ADMIN,SYS_ADMIN"` cis-docker-benchmark-5.3
35-
attrs['CONTAINER_CAPADD'] = ENV['CONTAINER_CAPADD'].nil? ? ENV['CONTAINER_CAPADD'] : ENV['CONTAINER_CAPADD'].split(',')
25+
REGISTRY_CERT_PATH = attribute(
26+
'registry_cert_path',
27+
description: 'directory contains various Docker registry directories. cis-docker-benchmark-3.7',
28+
default: '/etc/docker/certs.d'
29+
)
30+
31+
REGISTRY_NAME = attribute(
32+
'registry_name',
33+
description: 'directory contain certificate certain Docker registry. cis-docker-benchmark-3.7',
34+
default: '/etc/docker/certs.d/registry_hostname:port'
35+
)
36+
37+
REGISTRY_CA_FILE = attribute(
38+
'registry_ca_file',
39+
description: 'certificate file for a certain Docker registry certificate files. cis-docker-benchmark-3.7 and cis-docker-benchmark-3.8',
40+
default: '/etc/docker/certs.d/registry_hostname:port/ca.crt'
41+
)
42+
43+
CONTAINER_USER = attribute(
44+
'container_user',
45+
description: 'define user within containers. cis-docker-benchmark-4.1',
46+
default: 'ubuntu'
47+
)
48+
49+
CONTAINER_CAPADD = attribute(
50+
'container_capadd',
51+
description: 'define needed capabilities for containers.'
52+
)
3653

3754
# check if docker exists
3855
only_if do
@@ -251,21 +268,21 @@
251268
ref 'https://docs.docker.com/engine/security/certificates/'
252269
ref 'docs.docker.com/reference/commandline/cli/#insecure-registries'
253270

254-
describe file(attrs['REGISTRY_CERT_PATH']) do
271+
describe file(REGISTRY_CERT_PATH) do
255272
it { should exist }
256273
it { should be_directory }
257274
it { should be_owned_by 'root' }
258275
it { should be_grouped_into 'root' }
259276
end
260277

261-
describe file(attrs['REGISTRY_NAME']) do
278+
describe file(REGISTRY_NAME) do
262279
it { should exist }
263280
it { should be_directory }
264281
it { should be_owned_by 'root' }
265282
it { should be_grouped_into 'root' }
266283
end
267284

268-
describe file(attrs['REGISTRY_CA_FILE']) do
285+
describe file(REGISTRY_CA_FILE) do
269286
it { should exist }
270287
it { should be_file }
271288
it { should be_owned_by 'root' }
@@ -280,7 +297,7 @@
280297
ref 'https://docs.docker.com/engine/security/certificates/'
281298
ref 'docs.docker.com/reference/commandline/cli/#insecure-registries'
282299

283-
describe file(attrs['REGISTRY_CA_FILE']) do
300+
describe file(REGISTRY_CA_FILE) do
284301
it { should exist }
285302
it { should be_file }
286303
it { should be_readable }
@@ -505,7 +522,7 @@
505522

506523
docker.ps.each do |id|
507524
describe docker.inspect(id) do
508-
its(%w(Config User)) { should eq attrs['CONTAINER_USER'] }
525+
its(%w(Config User)) { should eq CONTAINER_USER }
509526
its(%w(Config User)) { should_not eq nil }
510527
end
511528
end
@@ -552,7 +569,7 @@
552569
describe docker.inspect(id) do
553570
its(%w(HostConfig CapDrop)) { should include(/all/) }
554571
its(%w(HostConfig CapDrop)) { should_not eq nil }
555-
its(%w(HostConfig CapAdd)) { should eq attrs['CONTAINER_CAPADD'] }
572+
its(%w(HostConfig CapAdd)) { should eq CONTAINER_CAPADD }
556573
end
557574
end
558575
end
@@ -601,7 +618,7 @@
601618
ref 'https://blog.docker.com/2014/06/why-you-dont-need-to-run-sshd-in-docker/'
602619

603620
docker.ps.each do |id|
604-
execute_command = 'docker exec ' << id << ' ps -e'
621+
execute_command = 'docker exec ' + id + ' ps -e'
605622
describe command(execute_command) do
606623
its('stdout') { should_not match(/ssh/) }
607624
end

‎controls/docker_level2.rb‎

Lines changed: 34 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -22,17 +22,35 @@
2222
title 'CIS Docker Benchmark - Level 2 - Docker'
2323

2424
# attributes
25-
attrs = {}
26-
# define authorization plugin to manage access to Docker daemon. cis-docker-benchmark-2.11
27-
attrs['AUTHORIZATION_PLUGIN'] = [ENV['AUTHORIZATION_PLUGIN'] || 'authz-broker']
28-
# define preferable way to store logs. cis-docker-benchmark-2.12
29-
attrs['LOG_DRIVER'] = ENV['LOG_DRIVER'] || 'syslog'
30-
# define Docker daemon log-opts. cis-docker-benchmark-2.12
31-
attrs['LOG_OPTS'] = ENV['LOG_OPTS'] || /syslog-address/
32-
# define apparmor profile for Docker containers. cis-docker-benchmark-5.1
33-
attrs['APP_ARMOR_PROFILE'] = ENV['APP_ARMOR_PROFILE'] || 'docker-default'
34-
# define SELinux profile for Docker containers. cis-docker-benchmark-5.2
35-
attrs['SELINUX_PROFILE'] = ENV['SELINUX_PROFILE'] || /label\:level\:s0-s0\:c1023/
25+
AUTHORIZATION_PLUGIN = attribute(
26+
'authorization_plugin',
27+
description: 'define authorization plugin to manage access to Docker daemon. cis-docker-benchmark-2.11',
28+
default: 'authz-broker'
29+
)
30+
31+
LOG_DRIVER = attribute(
32+
'log_driver',
33+
description: 'define preferable way to store logs. cis-docker-benchmark-2.12',
34+
default: 'syslog'
35+
)
36+
37+
LOG_OPTS = attribute(
38+
'log_opts',
39+
description: 'define Docker daemon log-opts. cis-docker-benchmark-2.12',
40+
default: /syslog-address/
41+
)
42+
43+
APP_ARMOR_PROFILE = attribute(
44+
'app_armor_profile',
45+
description: 'define apparmor profile for Docker containers. cis-docker-benchmark-5.1',
46+
default: 'docker-default'
47+
)
48+
49+
SELINUX_PROFILE = attribute(
50+
'selinux_profile',
51+
description: 'define SELinux profile for Docker containers. cis-docker-benchmark-5.2',
52+
default: /label\:level\:s0-s0\:c1023/
53+
)
3654

3755
# check if docker exists
3856
only_if do
@@ -88,7 +106,7 @@
88106
its(['authorization-plugins']) { should_not be_empty }
89107
end
90108
describe json('/etc/docker/daemon.json') do
91-
its(['authorization-plugins']) { should eq(attrs['AUTHORIZATION_PLUGIN']) }
109+
its(['authorization-plugins']) { should eq([AUTHORIZATION_PLUGIN]) }
92110
end
93111
end
94112

@@ -103,10 +121,10 @@
103121
its(['log-driver']) { should_not be_empty }
104122
end
105123
describe json('/etc/docker/daemon.json') do
106-
its(['log-driver']) { should eq(attrs['LOG_DRIVER']) }
124+
its(['log-driver']) { should eq(LOG_DRIVER) }
107125
end
108126
describe json('/etc/docker/daemon.json') do
109-
its(['log-opts']) { should include(attrs['LOG_OPTS']) }
127+
its(['log-opts']) { should include(LOG_OPTS) }
110128
end
111129
end
112130

@@ -148,7 +166,7 @@
148166
only_if { os[:family] == ('ubuntu' || 'debian') }
149167
docker.ps.each do |id|
150168
describe docker.inspect(id) do
151-
its(['AppArmorProfile']) { should include(attrs['APP_ARMOR_PROFILE']) }
169+
its(['AppArmorProfile']) { should include(APP_ARMOR_PROFILE) }
152170
its(['AppArmorProfile']) { should_not eq nil }
153171
end
154172
end
@@ -172,7 +190,7 @@
172190
docker.ps.each do |id|
173191
describe docker.inspect(id) do
174192
its(%w(HostConfig SecurityOpt)) { should_not eq nil }
175-
its(%w(HostConfig SecurityOpt)) { should include(attrs['SELINUX_PROFILE']) }
193+
its(%w(HostConfig SecurityOpt)) { should include(SELINUX_PROFILE) }
176194
end
177195
end
178196
end

‎sample_attributes.yml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
trusted_user: vagrant
2+
managable_container_number: 25
3+
registry_cert_path: /etc/docker/certs.d
4+
registry_name: /etc/docker/certs.d/registry_hostname:port
5+
registry_ca_file: /etc/docker/certs.d/registry_hostname:port/ca.crt
6+
container_user: vagrant
7+
container_capadd: null
8+
authorization_plugin: authz-broker
9+
log_driver: syslog
10+
log_opts: /syslog-address/
11+
app_armor_profile: docker-default
12+
selinux_profile: /label\:level\:s0-s0\:c1023/

0 commit comments

Comments
 (0)